Investigation Manager

Use the Investigation Manager in the Platform console to build node-based trees to discover, visualize, and understand connections between assets in the Censys datasets.

Your investigations can start with assets or queries. CensEye automated pivoting functionality is built into the manager to help you quickly find valuable insights.

The Investigation Manager is a beta feature available to users with access to the Threat Hunting module. At this time, users can only see, edit, and delete their own investigations.

Video overview

Create investigation

To create a new investigation and add its first node, use the following process.

1. In the Platform web UI, open the left-side navigation menu and select Investigate.
2. On the Investigation Manager page, click Create investigation.
3. Click the + Add Node button and select Asset Node or Query Node.
4. Enter the required information for your asset or query node, then click Add Node.

To delete a node, click the three-dot icon on the right side of the node card and then click Delete Node.

Create investigation from an asset or a collection page

To create a new investigation directly from an asset or a collection page, click the Start Investigation button in the top-right corner of the page.

Investigation composition

Investigations are composed of asset and query nodes and the connections between them.

Asset nodes

Assets nodes can be hosts (identified by an IP address), web properties (identified by an IP/hostname and port combination using the format hostname:port), or certificates (identified by a SHA-256 fingerprint) that are present in the Platform datasets.

View asset details

To see the full details for an asset, click the three-dot icon on the right side of the node card and then click View details.

Run CensEye on an asset

1. Click the lightbulb icon in the node card. The top results discovered via CensEye will display within the card.
2. Click on any result to create a connected query node for field-value pairs discovered by CensEye.

You can re-run CensEye on an asset by clicking the refresh icon in the node card.

Query nodes

Query nodes are composed of a valid Censys Query Language (CenQL) query. You can manually input query nodes or they can be discovered via CensEye pivots.

Run query

1. Click the magnifying glass icon in the node card. The first 100 results will be displayed.
2. Click on any result to create a connected asset node and continue your investigation.
   • To see the complete list of results for your search, click the three-dot icon on the right side of the node card and then click See Full Search Results.

Rename or delete investigation

To rename or delete an investigation, open the Actions menu above the investigation interface, then click Rename Investigation or Delete Investigation.

View investigations

On the Investigate page, in the top left corner of the page, click the arrow next to your current investigation's name to see all of your saved investigations.

Download investigation

You can download an investigation in JSON format to parse out specific nodes of interest or import your investigation into a React Flow interface.

To download your investigation in JSON format:

1. Click the Actions menu.
2. Select the Download JSON option.